The one-screen version: In one week, AI regulation split into two tracks heading in opposite directions. On October 14, eight state attorneys general each sued OpenAI — Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska, and West Virginia — alleging it misled consumers about ChatGPT's safety and failed to protect children, each under their own state's consumer-protection law. Two days later, Politico reported Anthropic had quietly handed Congress a draft bill that would let Washington block a model only for a foreseeable risk of $1 billion in damages or 50 deaths — and would preempt some state AI laws. One track is bottom-up, punitive, and already live. The other is top-down, preemptive, and so high-bar that no ordinary product trips it. Here's the fork, and why only one side of it reaches a solo founder.

1. The suits: fifty regimes, no new law needed#

Start with the track that has teeth today. On October 14, the attorneys general of eight states filed separate suits against OpenAI, each in its own state court. The through-line of the complaints, as reported, is consumer deception: that OpenAI overstated how safe ChatGPT is and under-delivered on protecting children and other vulnerable users. Several add privacy and product-liability claims. They want product changes, civil penalties, and damages.

The structural detail matters more than the headline. These aren't one coordinated federal case — they're eight filings under eight state consumer-protection statutes, the same body of law that governs a misleading nutrition label or a bait-and-switch warranty. Florida's AG opened this front back in June. No one had to pass an "AI law" to bring them; consumer-protection law already covers "you said it was safe and it wasn't," and it exists in all fifty states.

The regulation that reaches a small company first isn't a new AI statute. It's the hundred-year-old consumer-protection law that already governs every claim on your landing page.

OpenAI's response is that it ships age-specific protections and teen safeguards many rivals lack — which is the right defense to have built before the suit, not after.

2. The bill: one standard, a bar in the clouds#

Now the other track. On October 16, Politico reported that Anthropic had privately circulated a draft frontier-AI safety bill to lawmakers. Its defining feature is how little it lets the government do: Washington could move to block a model's release or use only when it poses a foreseeable, imminent risk of more than $1 billion in damages or of killing or seriously injuring more than 50 people — and only through three narrow harm paths: a biological weapon, a model evading its developer's controls, or a cyberattack. Even then, only the Commerce Department could petition a federal court to order a suspension; every other agency would be barred.

Around that high bar the draft wraps the obligations Anthropic already champions: published safety frameworks, transparency reports for new frontier models, whistleblower protections, and critical-incident reporting to Commerce. Anthropic says the proposal reflects its existing Advanced AI Framework. And critically, it would preempt some state AI-safety laws — a competing bipartisan effort, the Trahan–Obernolte FRONTIER Act, also carries preemption, and some observers call Anthropic's draft the weaker of the two.

Read it honestly and it's a lab writing the rules it would like to be judged by: catastrophe-only triggers, a single enforcer, court oversight, and a federal ceiling that would quiet the noisier state track. Whether that's responsible standard-setting or regulatory capture depends on where you sit — but note what it does not do. It says nothing about the thing that just happened to OpenAI.

3. Why only one fork reaches you#

Here's the part a founder should internalize. The frontier threshold everyone is arguing about — a billion dollars, fifty deaths, bioweapons — is not your threshold. Your RAG app, your agent, your AI SaaS will never foreseeably threaten $1 billion in damages or evade its own controls into a cyberattack. If that bar became law tomorrow, it would change nothing about your legal exposure.

What can reach you is the other track, the one with no dollar floor: a state attorney general applying plain consumer-protection law to the claims you make and the users you let in. Did you call a feature "safe," "secure," or "private" in a way you can't back up? Did minors end up on a product you never designed for them? Those are the hooks — and they scale all the way down to a one-person company, because consumer-protection law doesn't have a revenue minimum. It's the same dependency-risk discipline this column keeps returning to, from metering your vendor spend before finance does to reading what a lab's own economics signal about the layer you build on: the risk that gets you is rarely the dramatic one in the headline. It's the mundane one already written into law.

What to do before Monday#

Four moves, none requiring a general counsel:

Caveats: the eight-state suits are summarized from reporting by CNBC, The Hill, and legal-industry analysis, not from the complaints read in full; details and the exact count may be refined as filings are docketed. The Anthropic bill is a confidential draft described by Politico and secondary coverage, not published legislative text, and its provisions could change before anything is formally introduced. We'll revise against primary documents as they post.